Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:pxe_c8:pxe_2 [12.06.2020 16:28. ] – [Bsp. 3: erweiterte Automatisierung der Installation] django | centos:pxe_c8:pxe_2 [04.07.2020 15:32. ] (aktuell) – [Links] django | ||
|---|---|---|---|
| Zeile 40: | Zeile 40: | ||
| <WRAP center round important 90%> | <WRAP center round important 90%> | ||
| - | Ferner ist zu beachten, dass viele sehr individuelle Konfigurationswünsche, | + | Ferner ist zu beachten, dass viele sehr individuelle Konfigurationswünsche, |
| </ | </ | ||
| Zeile 268: | Zeile 268: | ||
| Neben der Grundinstallation eines CentOS 8 Hosts werden wir nun noch folgende Dinge setzen lassen: | Neben der Grundinstallation eines CentOS 8 Hosts werden wir nun noch folgende Dinge setzen lassen: | ||
| + | - **IP-Adresse und Hostname** Durch Angabe des Hostnamens beim Booten des Installationsimages wollen wir diesen setzen und auch die zugehörige IP-Adresse übernehmen lassen. (Der Hostname wir so z.B. auch bei der Definition der VolumeGroup eines LVMs verwendet.) | ||
| + | - **[[centos: | ||
| + | - **[[centos: | ||
| + | - **[[centos: | ||
| + | - **[[centos: | ||
| + | - **[[wiki: | ||
| + | - **Update** Zum Schluss stellen wir noch sicher dass alle installierten Pakete in der aktuellsten Version vorliegen und lassen dann das System neu starten. | ||
| + | Hierzu erweitern wir die zuvor angelegte Kickstartdatei // | ||
| + | # vim / | ||
| - | <WRAP center round todo 35%> | + | <file bash / |
| - | \\ FIXME **//... do geds weida!//** FIXME | + | # Version=CentOS |
| - | </ | + | |
| - | + | ||
| - | + | ||
| - | - **IP-Adresse und Hostname** Durch Angabe des Hostnamens wollen wir diesen setzen und auch die zugehörige IP-Adresse gleich setzen lassen. Der Hostname wir so z.B. auch bei der Definition der VolumeGroup eines LVMs verwendet. | + | |
| - | - **Bootloader** Da wir beim Booten der Maschine detailierte Informationen sehen wollen werden wir die Option **rhgb** in der GRUB-Definition entfernen. | + | |
| - | - **MOTD und ISSUE.NET** individualisieren inkl. Hostnamen | + | |
| - | - **Repositories** Statt der öffentlichen, | + | |
| - | - **Changlogs und YUM** Für spätere Updates aktivieren wir die Anzeige der Changeloginformationen standardmässig aktiviert. | + | |
| - | - **SSH-Daemon** Den SSH Daemon härten wir und passen die Konfigurationsdatei entsprechend an. | + | |
| - | - **SSH-Publickey** Für unseren Adminaccount **django** hinterlegen wir den zugehörigen öffentlichen SSH-Schlüssel. | + | |
| - | - **DNS-Suche** Bei der Suche im DNS passen wir die Suchliste unseren Bedürfnissen an. | + | |
| - | - **Postfix** Den MTA Postfix statten wir mit einer Grundkonfiguration entsprechend unserer Schutzzone aus. | + | |
| - | - **chronyd-Zeitserver** Zur Nutzung unseres Zeitservers im Netz definieren wir die passende Konfigurationsdatei. | + | |
| - | + | ||
| - | Hierzu erweitern wir die zuvor angelegte Kickstartdatei // | + | |
| - | # vim / | + | |
| - | + | ||
| - | <file bash / | + | |
| - | # Version=CentOS | + | |
| # Tastaturlayout definieren | # Tastaturlayout definieren | ||
| - | keyboard --vckeymap=de --xlayouts=' | + | keyboard --vckeymap=de-nodeadkeys |
| # Systemsprache setzen | # Systemsprache setzen | ||
| lang en_US.UTF-8 | lang en_US.UTF-8 | ||
| - | # Definition der Netzwerkeinstellungen | + | # Definition der Netzwerkeinstellungeni - setzen der Netzwerk-Adresse und Hostname |
| - | # Network information | + | # die aus dem Preinstall-Script beim PXE-Boot übernommen wurden. |
| - | network | + | %include / |
| - | network | + | |
| # Zeitzone setzen | # Zeitzone setzen | ||
| - | timezone Europe/ | + | timezone Europe/ |
| + | services --enabled=" | ||
| # Netzwerkinstallation aus dem eigenen Repository mit den aktuellen Paketen | # Netzwerkinstallation aus dem eigenen Repository mit den aktuellen Paketen | ||
| - | repo --name=installupdates --baseurl=http:// | + | url --url="http:// |
| - | + | repo --name=" | |
| - | # Authentifizierungsoptionen für das System definieren | + | |
| - | auth --enableshadow | + | |
| # Root-Passwort verschlüsselt vorgeben | # Root-Passwort verschlüsselt vorgeben | ||
| - | rootpw --iscrypted $6$PZhVKqBb7vE5NgOq$fuqZ6zwDjbK214BUqjEIjxBuR$cH1cK$1nD2V0lLD3PpmfKIlK14b71RsTmkRLqTmxZyr0YmCrl8sgkgIuj7N3B1TG67/ | + | rootpw --iscrypted $6$Z46HtZ/ |
| # Default-Benutzerkonto anlegen | # Default-Benutzerkonto anlegen | ||
| - | user --name=django --password=$6$34os/ | + | user --name=django --password=$6$2.fGKBeQa18GE6XwDMXG6$QX/j.TfZXk0bBuoJ8GE6XMXRZYz/4pEE6PuwkubaDmteRAAerLVKK69EF30d1K/ |
| # vorhandene Partitionen löschen | # vorhandene Partitionen löschen | ||
| - | clearpart --all --initlabel --drives=vda | + | ignoredisk --only-use=vda |
| + | clearpart --all --initlabel --drives=vda | ||
| + | # autopart --type=lvm | ||
| - | # Konfiguration des System Bootloaders | + | # GUI für Installation verwenden |
| - | bootloader --location=mbr --boot-drive=vda | + | graphical |
| - | # SELinux permissive Modus aktivieren | + | # Kein X Window System konfigurieren, |
| - | selinux --permissive | + | skipx |
| - | + | ||
| - | # Disable kdump | + | |
| - | services --disabled=bluetooth, | + | |
| # Reboot nach der Installation ausführen | # Reboot nach der Installation ausführen | ||
| Zeile 335: | Zeile 322: | ||
| # Paketauswahl definieren (Minimalinstallation mit zusätzlichen Paketen | # Paketauswahl definieren (Minimalinstallation mit zusätzlichen Paketen | ||
| %packages | %packages | ||
| - | @core | + | @^minimal-environment |
| - | #-selinux-policy* | + | |
| -iwl*firmware | -iwl*firmware | ||
| vim | vim | ||
| - | mc | + | bash-completion |
| bind-utils | bind-utils | ||
| wget | wget | ||
| telnet | telnet | ||
| - | yum-priorities | ||
| - | acpid | ||
| net-tools | net-tools | ||
| - | yum-plugin-changelog | ||
| lsof | lsof | ||
| + | %end | ||
| + | %addon com_redhat_kdump --disable --reserve-mb=' | ||
| %end | %end | ||
| + | |||
| + | %anaconda | ||
| + | pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty | ||
| + | pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok | ||
| + | pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty | ||
| + | %end | ||
| + | |||
| + | #%end | ||
| + | |||
| %addon com_redhat_kdump --disable --reserve-mb=' | %addon com_redhat_kdump --disable --reserve-mb=' | ||
| + | |||
| %end | %end | ||
| # Preinstall-Anweisungen Netzwerk-Adresse und Hostname ermitteln und setzen | # Preinstall-Anweisungen Netzwerk-Adresse und Hostname ermitteln und setzen | ||
| - | %pre | + | %pre |
| #!/bin/bash | #!/bin/bash | ||
| echo " | echo " | ||
| Zeile 362: | Zeile 357: | ||
| NULL=${SERVERNAME: | NULL=${SERVERNAME: | ||
| if [ " | if [ " | ||
| - | | + | |
| else | else | ||
| if [ " | if [ " | ||
| Zeile 369: | Zeile 364: | ||
| OCTET=${SERVERNAME: | OCTET=${SERVERNAME: | ||
| fi | fi | ||
| - | | + | echo " |
| - | | + | |
| fi | fi | ||
| ;; | ;; | ||
| Zeile 391: | Zeile 385: | ||
| ######################## | ######################## | ||
| - | | + | # / |
| cat << | cat << | ||
| ############################################################################## | ############################################################################## | ||
| Zeile 404: | Zeile 398: | ||
| ############################################################################## | ############################################################################## | ||
| ISSUE.NET | ISSUE.NET | ||
| - | | + | |
| - | chmod 644 / | + | chown root:root / |
| - | # /etc/motd anlegen | + | chmod 644 / |
| + | |||
| + | # /etc/motd anlegen | ||
| cat << | cat << | ||
| ############################################################################## | ############################################################################## | ||
| Zeile 412: | Zeile 408: | ||
| # This is the home server of Michael Nausch. | # This is the home server of Michael Nausch. | ||
| # # | # # | ||
| - | # $SERVERNAME.dmz.nausch.org | + | # $SERVERNAME.nausch.org |
| # # | # # | ||
| # | # | ||
| Zeile 421: | Zeile 417: | ||
| ############################################################################## | ############################################################################## | ||
| MOTD | MOTD | ||
| + | |||
| chown root:root /etc/motd | chown root:root /etc/motd | ||
| chmod 644 /etc/motd | chmod 644 /etc/motd | ||
| ################################################################################# | ################################################################################# | ||
| - | #################### | + | ########################### |
| - | rm -f / | + | cp -a / |
| - | cat <<REPOSITORY | + | cat << |
| - | # CentOS-LOCAL.repo | + | # $OpenBSD: sshd_config, |
| + | |||
| + | # This is the sshd server system-wide configuration file. See | ||
| + | # sshd_config(5) for more information. | ||
| + | |||
| + | # This sshd was compiled with PATH=/ | ||
| + | |||
| + | # The strategy used for options in the default sshd_config shipped with | ||
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| + | |||
| + | # If you want to change the port on a SELinux system, you have to tell | ||
| + | # SELinux about this change. | ||
| + | # semanage port -a -t ssh_port_t -p tcp # | ||
| + | # | ||
| + | # Specifies which address family should be used by sshd(8). Valid arguments | ||
| + | # are '' | ||
| + | # | ||
| + | |||
| + | # Specifies the local addresses sshd(8) should listen on. The following | ||
| + | # forms may be used: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # If port is not specified, sshd will listen on the address and all prior | ||
| + | # Port options specified. The default is to listen on all local addresses. | ||
| + | # Multiple ListenAddress options are permitted. Additionally, | ||
| + | # options must precede this option for non-port qualified addresses. | ||
| + | #Port 22 | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Specifies a file containing a private host key used by SSH. The default | ||
| + | # is / | ||
| + | # / | ||
| + | # version 2. Note that sshd(8) will refuse to use a file if it is | ||
| + | # group/ | ||
| + | # '' | ||
| + | # version 2 of the SSH protocol. | ||
| + | HostKey / | ||
| + | |||
| + | # Specifies the ciphers allowed for protocol version 2. Multiple ciphers | ||
| + | # must be comma-separated. The supported ciphers are '' | ||
| + | # '' | ||
| + | # '' | ||
| + | # '' | ||
| + | Ciphers chacha20-poly1305@openssh.com, | ||
| + | |||
| + | # MACs' Specifies the available MAC (message authentication code) | ||
| + | # algorithms. The MAC algorithm is used in protocol version 2 for data | ||
| + | # integrity protection. Multiple algorithms must be comma-separated. | ||
| + | MACs hmac-sha2-512-etm@openssh.com, | ||
| + | |||
| + | # Specifies the available KEX (Key Exchange) algorithms. Multiple | ||
| + | # algorithms must be comma-separated. For ineroperability with Eclipse | ||
| + | # and WinSCP): | ||
| + | # KexAlgorithms curve25519-sha256@libssh.org, | ||
| + | # If needed, open / | ||
| + | # 5th column is less than 2000. | ||
| + | # awk '$5 > 2000' / | ||
| + | # wc -l " | ||
| + | # make sure there is something left | ||
| + | # mv " | ||
| + | # | ||
| + | KexAlgorithms curve25519-sha256@libssh.org | ||
| + | |||
| + | # Ciphers and keying | ||
| + | #RekeyLimit default none | ||
| + | |||
| + | # System-wide Crypto policy: | ||
| + | # This system is following system-wide crypto policy. The changes to | ||
| + | # Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any | ||
| + | # effect here. They will be overridden by command-line options passed on | ||
| + | # the server start up. | ||
| + | # To opt out, uncomment a line with redefinition of CRYPTO_POLICY= | ||
| + | # variable in / | ||
| + | # For more information, | ||
| + | |||
| + | # Logging | ||
| + | # Gives the facility code that is used when logging messages from sshd(8). | ||
| + | # The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, | ||
| + | # LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. | ||
| + | SyslogFacility AUTHPRIV | ||
| + | |||
| + | # Gives the verbosity level that is used when logging messages from sshd(8). | ||
| + | # The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, | ||
| + | # DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are | ||
| + | # equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging | ||
| + | # output. Logging with a DEBUG level violates the privacy of users and is | ||
| + | # not recommended. | ||
| + | # LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a | ||
| + | # clear audit track of which key was using to log in. | ||
| + | LogLevel VERBOSE | ||
| + | |||
| + | # Authentication: | ||
| + | # The server disconnects after this time if the user has not successfully | ||
| + | # logged in. If the value is 0, there is no time limit. | ||
| + | LoginGraceTime 0 | ||
| + | |||
| + | # Specifies whether root can log in using ssh(1). The argument must be | ||
| + | # '' | ||
| + | # The default is '' | ||
| + | # password authentication is disabled for root. If this option is set to | ||
| + | # '' | ||
| + | # be allowed, but only if the command option has been specified (which | ||
| + | # may be useful for taking remote backups even if root login is normally | ||
| + | # not allowed). All other authentication methods are disabled for root. | ||
| + | # If this option is set to '' | ||
| + | PermitRootLogin no | ||
| + | |||
| + | # This keyword can be followed by a list of user name patterns, separated | ||
| + | # by spaces. If specified, login is allowed only for user names that match | ||
| + | # one of the patterns. Only user names are valid; a numerical user ID is | ||
| + | # not recognized. By default, login is allowed for all users. If the pattern | ||
| + | # takes the form USER@HOST then USER and HOST are separately checked, | ||
| + | # restricting logins to particular users from particular hosts. The | ||
| + | # allow/deny directives are processed in the following order: | ||
| + | # DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. | ||
| + | AllowUsers django | ||
| + | |||
| + | # Specifies whether sshd(8) should check file modes and ownership of the | ||
| + | # user's files and home directory before accepting login. This is normally | ||
| + | # desirable because novices sometimes accidentally leave their directory | ||
| + | # or files world-writable. | ||
| + | StrictModes yes | ||
| + | |||
| + | # Specifies the maximum number of authentication attempts permitted per | ||
| + | # connection. Once the number of failures reaches half this value, | ||
| + | # additional failures are logged. | ||
| + | MaxAuthTries 10 | ||
| + | |||
| + | # Specifies the maximum number of open sessions permitted per network | ||
| + | # connection. | ||
| + | MaxSessions 10 | ||
| + | |||
| + | # Specifies the file that contains the public keys that can be used for | ||
| + | # user authentication. AuthorizedKeysFile may contain tokens of the form | ||
| + | # %T which are substituted during connection setup. The following tokens | ||
| + | # are defined: %% is replaced by a literal ' | ||
| + | # home directory of the user being authenticated, | ||
| + | # the username of that user. After expansion, AuthorizedKeysFile is | ||
| + | # taken to be an absolute path or one relative to the user's home directory. | ||
| + | AuthorizedKeysFile | ||
| + | |||
| + | # Specifies whether public key authentication is allowed. The default is | ||
| + | # '' | ||
| + | PubkeyAuthentication yes | ||
| + | |||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # For this to work you will also need host keys in / | ||
| + | # | ||
| + | # Change to yes if you don't trust ~/ | ||
| + | # HostbasedAuthentication | ||
| + | # | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | # | ||
| + | |||
| + | # To disable tunneled clear text passwords, change to no here! | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Specifies whether password authentication is allowed. To disable tunneled | ||
| + | # clear text passwords, change to no here! | ||
| + | PasswordAuthentication no | ||
| + | |||
| + | # Specifies whether challenge-response authentication is allowed | ||
| + | # (e.g. via PAM or though authentication styles supported in login.conf(5)) | ||
| + | # Change to no to disable s/key passwords | ||
| + | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Specifies whether user authentication based on GSSAPI is allowed. | ||
| + | GSSAPIAuthentication yes | ||
| + | |||
| + | # Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key | ||
| + | # exchange doesn' | ||
| + | # | ||
| + | |||
| + | # Specifies whether to automatically destroy the user's credentials cache | ||
| + | # on logout. | ||
| + | GSSAPICleanupCredentials no | ||
| + | |||
| + | # Determines whether to be strict about the identity of the GSSAPI acceptor | ||
| + | # a client authenticates against. If '' | ||
| + | # against the host service on the current hostname. If '' | ||
| + | # may authenticate against any service key stored in the machine' | ||
| + | # store. This facility is provided to assist with operation on multi homed | ||
| + | # machines. The default is '' | ||
| + | # protocol version 2 GSSAPI connections, | ||
| + | # work with recent Kerberos GSSAPI libraries. | ||
| + | # | ||
| + | |||
| + | # | ||
| + | |||
| + | # Set this to ' | ||
| + | # and session processing. If this is enabled, PAM authentication will | ||
| + | # be allowed through the ChallengeResponseAuthentication and | ||
| + | # PasswordAuthentication. | ||
| + | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
| + | # the setting of " | ||
| + | # If you just want the PAM account and session checks to run without | ||
| + | # PAM authentication, | ||
| + | # and ChallengeResponseAuthentication to ' | ||
| + | # WARNING: ' | ||
| + | # problems. | ||
| + | UsePAM yes | ||
| + | |||
| + | # Specifies whether X11 forwarding is permitted. The argument must be | ||
| + | # '' | ||
| + | # When X11 forwarding is enabled, there may be additional exposure to the | ||
| + | # server and to client displays if the sshd(8) proxy display is configured | ||
| + | # to listen on the wildcard address (see X11UseLocalhost below), though this | ||
| + | # is not the default. Additionally, | ||
| + | # authentication data verification and substitution occur on the client side. | ||
| + | # The security risk of using X11 forwarding is that the client' | ||
| + | # server may be exposed to attack when the SSH client requests forwarding | ||
| + | # (see the warnings for ForwardX11 in ssh_config(5)). A system administrator | ||
| + | # may have a stance in which they want to protect clients that may expose | ||
| + | # themselves to attack by unwittingly requesting X11 forwarding, which can | ||
| + | # warrant a '' | ||
| + | # prevent users from forwarding X11 traffic, as users can always install | ||
| + | # their own forwarders. X11 forwarding is automatically disabled if UseLogin | ||
| + | # is enabled. | ||
| + | X11Forwarding yes | ||
| + | |||
| + | # Specifies the first display number available for sshd(8)' | ||
| + | # This prevents sshd from interfering with real X11 servers. | ||
| + | # The default is 10. | ||
| + | # | ||
| + | |||
| + | # Specifies whether sshd(8) should bind the X11 forwarding server to the | ||
| + | # loopback address or to the wildcard address. By default, sshd binds the | ||
| + | # forwarding server to the loopback address and sets the hostname part of | ||
| + | # the DISPLAY environment variable to '' | ||
| + | # hosts from connecting to the proxy display. However, some older X11 clients | ||
| + | # may not function with this configuration. X11UseLocalhost may be set to | ||
| + | # '' | ||
| + | # wildcard address. The argument must be '' | ||
| + | # '' | ||
| + | # | ||
| + | |||
| + | # Specifies whether ssh-agent(1) forwarding is permitted. The default is | ||
| + | # '' | ||
| + | # unless users are also denied shell access, as they can always install | ||
| + | # their own forwarders. | ||
| + | # | ||
| + | |||
| + | # Specifies whether TCP forwarding is permitted. The default is '' | ||
| + | # Note that disabling TCP forwarding does not improve security unless users | ||
| + | # are also denied shell access, as they can always install their own | ||
| + | # forwarders. | ||
| + | # | ||
| + | |||
| + | # Specifies whether remote hosts are allowed to connect to ports forwarded | ||
| + | # for the client. By default, sshd(8) binds remote port forwardings to the | ||
| + | # loopback address. This prevents other remote hosts from connecting to | ||
| + | # forwarded ports. GatewayPorts can be used to specify that sshd should | ||
| + | # allow remote port forwardings to bind to non-loopback addresses, thus | ||
| + | # allowing other hosts to connect. The argument may be '' | ||
| + | # remote port forwardings to be available to the local host only, '' | ||
| + | # to force remote port forwardings to bind to the wildcard address, or | ||
| + | # '' | ||
| + | # the forwarding is bound. The default is '' | ||
| + | # | ||
| + | |||
| + | #PermitTTY yes | ||
| + | |||
| + | # It is recommended to use pam_motd in / | ||
| + | # as it is more configurable and versatile than the built-in version. | ||
| + | PrintMotd no | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS no | ||
| + | #PidFile / | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # The contents of the specified file are sent to the remote user before | ||
| + | # authentication is allowed. | ||
| + | Banner / | ||
| + | |||
| + | # Accept locale-related environment variables | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | |||
| + | # Configures an external subsystem (e.g. file transfer daemon). Arguments | ||
| + | # should be a subsystem name and a command (with optional arguments) to | ||
| + | # execute upon subsystem request. Log sftp level file access | ||
| + | # (read/ | ||
| + | Subsystem sftp / | ||
| + | |||
| + | # Example of overriding settings on a per-user basis | ||
| + | #Match User anoncvs | ||
| + | # | ||
| + | # | ||
| + | # PermitTTY no | ||
| + | # | ||
| + | SSHD_CONFIG | ||
| + | chown root:root / | ||
| + | chmod 600 / | ||
| + | ################################################################################# | ||
| + | |||
| + | ####################### | ||
| + | mkdir / | ||
| + | chmod 700 / | ||
| + | chown django: | ||
| + | cat << | ||
| + | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AA/ | ||
| + | AUTHORIZED_KEYS | ||
| + | chmod 644 / | ||
| + | chown django: | ||
| + | ################################################################################# | ||
| + | |||
| + | ############### | ||
| + | cp -a / | ||
| + | cat <<CENTOS-APPSTREAM | ||
| + | # CentOS-AppStream.repo | ||
| # | # | ||
| - | # This file uses a new mirrorlist system developed by Lance Davis for CentOS. | ||
| # The mirror system uses the connecting IP address of the client and the | # The mirror system uses the connecting IP address of the client and the | ||
| # update status of each mirror to pick mirrors that are updated to and | # update status of each mirror to pick mirrors that are updated to and | ||
| Zeile 436: | Zeile 769: | ||
| # unless you are manually picking other mirrors. | # unless you are manually picking other mirrors. | ||
| # | # | ||
| - | # If the mirrorlist= does not work for you, as a fall back you can try the | + | # If the mirrorlist= does not work for you, as a fall back you can try the |
| # remarked out baseurl= line instead. | # remarked out baseurl= line instead. | ||
| # | # | ||
| - | # Version für den Zugriff auf das lokale Centos-Repository | + | # |
| - | [base-LC] | + | [AppStream] |
| - | name=CentOS-7 - Base | + | name=CentOS-\$releasever |
| - | baseurl=http:// | + | baseurl=http:// |
| - | priority=1 | + | |
| - | exclude=dovecot* | + | |
| gpgcheck=1 | gpgcheck=1 | ||
| - | gpgkey=file:/// | + | enabled=1 |
| + | gpgkey=file:/// | ||
| + | CENTOS-APPSTREAM | ||
| + | chown root:root / | ||
| + | chmod 644 / | ||
| - | #released | + | cp -a / |
| - | [updates-LC] | + | cat << |
| - | name=CentOS-7 - Updates | + | # CentOS-Base.repo |
| - | baseurl=http:// | + | # |
| - | priority=1 | + | # The mirror system uses the connecting IP address of the client and the |
| - | exclude=dovecot* | + | # update status of each mirror to pick mirrors that are updated to and |
| + | # geographically close to the client. | ||
| + | # unless you are manually picking other mirrors. | ||
| + | # | ||
| + | # If the mirrorlist= does not work for you, as a fall back you can try the | ||
| + | # remarked out baseurl= line instead. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | [BaseOS] | ||
| + | name=CentOS-\$releasever | ||
| + | baseurl=http:// | ||
| gpgcheck=1 | gpgcheck=1 | ||
| - | gpgkey=file:/// | + | enabled=1 |
| + | gpgkey=file:/// | ||
| + | CENTOS-BASE | ||
| + | chown root:root / | ||
| + | chmod 644 / | ||
| + | |||
| + | cp -a / | ||
| + | cat << | ||
| + | # CentOS-Extras.repo | ||
| + | # | ||
| + | # The mirror system uses the connecting IP address of the client and the | ||
| + | # update status of each mirror to pick mirrors that are updated to and | ||
| + | # geographically close to the client. | ||
| + | # unless you are manually picking other mirrors. | ||
| + | # | ||
| + | # If the mirrorlist= does not work for you, as a fall back you can try the | ||
| + | # remarked out baseurl= line instead. | ||
| + | # | ||
| + | # | ||
| #additional packages that may be useful | #additional packages that may be useful | ||
| - | [extras-LC] | + | [extras] |
| - | name=CentOS-7 - Extras | + | name=CentOS-\$releasever |
| - | baseurl=http:// | + | baseurl=http:// |
| - | priority=1 | + | |
| - | gpgcheck=1 | + | |
| - | enabled = 1 | + | |
| - | gpgkey=file: | + | |
| - | + | ||
| - | #additional packages that extend functionality of existing packages | + | |
| - | [centosplus-LC] | + | |
| - | name=CentOS-7 - Plus | + | |
| - | baseurl=http:// | + | |
| - | priority=2 | + | |
| gpgcheck=1 | gpgcheck=1 | ||
| enabled=1 | enabled=1 | ||
| - | gpgkey=file:/// | + | gpgkey=file:/// |
| - | REPOSITORY | + | CENTOS-EXTRAS |
| - | chown root:root / | + | chown root:root / |
| - | chmod 644 / | + | chmod 644 / |
| - | rpm --import / | + | |
| ################################################################################# | ################################################################################# | ||
| - | ################### | + | ###### |
| - | cat <<MAILSERVER.GURU | + | dnf install epel-release -y |
| - | [mailserver.guru-os] | + | rpm --import https:// |
| - | name=Extra | + | |
| - | baseurl=http:// | + | cp -a / |
| - | priority=5 | + | cat <<EPEL-MODULAR |
| + | [epel-modular] | ||
| + | name=Extra Packages for Enterprise Linux Modular \$releasever | ||
| + | baseurl=http:// | ||
| enabled=1 | enabled=1 | ||
| gpgcheck=1 | gpgcheck=1 | ||
| - | gpgkey=file:/// | + | gpgkey=file:/// |
| + | [epel-modular-debuginfo] | ||
| + | name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Debug | ||
| + | baseurl=http:// | ||
| + | enabled=0 | ||
| + | gpgkey=file:/// | ||
| + | gpgcheck=1 | ||
| - | [mailserver.guru-testing] | + | [epel-modular-source] |
| - | name=Testing (Mailserver-)Packages for Enterprise Linux 7 - $basearch | + | name=Extra Packages for Enterprise Linux Modular \$releasever |
| - | baseurl=http:// | + | baseurl=http:// |
| - | priority=5 | + | |
| enabled=0 | enabled=0 | ||
| + | gpgkey=file:/// | ||
| gpgcheck=1 | gpgcheck=1 | ||
| - | gpgkey=file:/// | ||
| - | MAILSERVER.GURU | ||
| - | chown root:root / | ||
| - | chmod 644 / | ||
| - | rpm --import http:// | ||
| - | ################################################################################# | ||
| - | ########################### | + | EPEL-MODULAR |
| + | chown root:root / | ||
| + | chmod 644 / | ||
| + | |||
| + | cp -a / | ||
| cat << | cat << | ||
| [epel] | [epel] | ||
| - | name=Extra Packages for Enterprise Linux 7 - \$basearch | + | name=Extra Packages for Enterprise Linux \$releasever |
| - | baseurl=http:// | + | baseurl=http:// |
| - | # | + | |
| - | failovermethod=priority | + | |
| enabled=1 | enabled=1 | ||
| gpgcheck=1 | gpgcheck=1 | ||
| - | priority = 10 | + | gpgkey=file:/// |
| - | gpgkey=file:/// | + | |
| [epel-debuginfo] | [epel-debuginfo] | ||
| - | name=Extra Packages for Enterprise Linux 7 - \$basearch - Debug | + | name=Extra Packages for Enterprise Linux \$releasever |
| - | #baseurl=http:// | + | baseurl=http:// |
| - | mirrorlist=https: | + | |
| - | failovermethod=priority | + | |
| enabled=0 | enabled=0 | ||
| - | gpgkey=file:/// | + | gpgkey=file:/// |
| gpgcheck=1 | gpgcheck=1 | ||
| [epel-source] | [epel-source] | ||
| - | name=Extra Packages for Enterprise Linux 7 - \$basearch - Source | + | name=Extra Packages for Enterprise Linux \$releasever |
| - | #baseurl=http:// | + | baseurl=http:// |
| - | mirrorlist=https:// | + | |
| - | failovermethod=priority | + | |
| enabled=0 | enabled=0 | ||
| - | gpgkey=file:/// | + | gpgkey=file:/// |
| gpgcheck=1 | gpgcheck=1 | ||
| EPEL | EPEL | ||
| chown root:root / | chown root:root / | ||
| chmod 644 / | chmod 644 / | ||
| - | rpm --import https:// | ||
| ################################################################################# | ################################################################################# | ||
| - | #################### | + | #################### |
| - | rm -f / | + | dnf update |
| - | cat << | + | ################################################################################# |
| - | [main] | + | ;; |
| - | enabled=1 | + | esac; |
| + | done | ||
| + | %end | ||
| - | # Set to 'pre' | + | </ |
| - | when=pre | + | |
| - | # Set to true, to always get the output | + | Damit nun beim Laden der Menüdatei bei PXE-Boot die überarbeitete Kickstart-Datei geladen werden kann, erweitern wir nun die Menü-Datei unseres PXE-Bootservers. |
| - | # Django | + | |
| - | # default: always=false | + | # vim / |
| - | always=true | + | Dort tragen wir beim betreffenden **LABEL** die Optionen **'' |
| - | CHANGELOG | + | < |
| - | chown root:root /etc/yum/pluginconf.d/changelog.conf | + | MENU LABEL ^3) Installation von CentOS 8 (64 Bit) |
| - | chmod 644 /etc/yum/pluginconf.d/changelog.conf | + | |
| + | | ||
| + | </ | ||
| + | |||
| + | Anschliessend starten wir wie gewohnt unsere virtuelle Maschine. | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | <WRAP center round tip 80%> | ||
| + | |||
| + | Zum Setzen des Hostnamens wählen wir nun wie gewünscht den betreffenden Menüpunkt aus, drücken dann aber **__NICHT__** die **EINGABETASTE**, | ||
| + | </ | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Am Ende des Installationsvorganges werden wir informiert, dass das postinstall-script, | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Nach kurzer Wartezeit haben wir ein neues, vorkonfiguriertes und vor allem aktuelles System, bei dem wir uns direkt per **'' | ||
| + | $ ssh 10.0.0.50 | ||
| + | |||
| + | < | ||
| + | ED25519 key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | ############################################################################## | ||
| + | # # | ||
| + | # This is a private home server. | ||
| + | # # | ||
| + | # Unauthorized access | ||
| + | # # | ||
| + | # This system is actively monitored and all connections may be logged. | ||
| + | # By accessing this system, you consent | ||
| + | # # | ||
| + | ############################################################################## | ||
| + | ############################################################################## | ||
| + | # # | ||
| + | # This is the home server of Michael Nausch. | ||
| + | # # | ||
| + | # vml000050.nausch.org | ||
| + | # # | ||
| + | # | ||
| + | # # | ||
| + | # This system is actively monitored and all connections may be logged. | ||
| + | # By accessing this system, you consent to this monitoring. | ||
| + | # # | ||
| + | ##############################################################################</ | ||
| + | |||
| + | Die Netzwerkschnittstelle hat entsprechend die gewünschte Bezeichnung erhalten. | ||
| + | # ip a | ||
| + | |||
| + | < | ||
| + | link/ | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | | ||
| + | inet6 ::1/128 scope host | ||
| + | | ||
| + | 2: eth0: < | ||
| + | link/ether 52: | ||
| + | inet 10.0.0.50/ | ||
| + | | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | |||
| + | Das System ist auch mit den aktuellesten Programmpaketen bestückt. | ||
| + | # dnf update | ||
| + | |||
| + | < | ||
| + | Dependencies resolved. | ||
| + | Nothing to do. | ||
| + | Complete!</ | ||
| + | |||
| + | ==== Bsp. 4: Kickstart für eigene Installationsimages/ | ||
| + | Beim letzten Konfigurationsbeispiel gehen wir davon aus, dass wir unseren CentOS 8 Host nicht via PXE-Boot betanken können, sondern über den Umweg eines ISO-Files. Ntürlich wollen wir auch hier den Installations und anschließenden grundlegenden Erstkonfiguirationsaufwand möglichst gering halten. | ||
| + | |||
| + | Wir werden also unsere Kickstart-Datei in das vorhandene ***[[http:// | ||
| + | |||
| + | Zum Packen des iso-Images benötigen wir das Programm aus dem RPM-Paket **genisoimage**. Zum Validieren der Kickstart-Datei benötigen wir das Programm **'' | ||
| + | |||
| + | Zunächst installieren wir, falls noch nicht im System vorhanden die drei RPM. | ||
| + | # dnf install genisoimage pykickstart isomd5sum -y | ||
| + | |||
| + | Dann holen wir uns das ISO-Image auf unsere Admin-Workstation. | ||
| + | # wget http:// | ||
| + | |||
| + | Damit wir den Inhalt dieser ISO-Installations-DVD nach unseren Wünschen anpassen können werden wir diese Datei in unser Dateisystem einbinden. Den entsprechenden Pfad definieren wir uns nun noch. | ||
| + | # mkdir /mnt/iso | ||
| + | |||
| + | Nun mounten wir das ISO-Image. | ||
| + | # | ||
| + | |||
| + | Anschließend wechseln wir in das Verzeichnis **''/ | ||
| + | |||
| + | Im Verzeichnis **isolinux** legen wir dann unser Kickstartfile **'' | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | # Version=CentOS 8 (RHEL 8)# | ||
| + | |||
| + | # Tastaturlayout definieren | ||
| + | keyboard --vckeymap=de-nodeadkeys --xlayouts=' | ||
| + | |||
| + | # Systemsprache setzen | ||
| + | lang en_US.UTF-8 | ||
| + | |||
| + | # Definition der Netzwerkeinstellungen | ||
| + | network | ||
| + | network | ||
| + | |||
| + | # Zeitzone setzen | ||
| + | timezone Europe/ | ||
| + | services --enabled=" | ||
| + | |||
| + | # Installationsquelle setzen (eigenes ISO-Image) | ||
| + | repo --name=" | ||
| + | cdrom | ||
| + | |||
| + | # Root-Passwort verschlüsselt vorgeben | ||
| + | rootpw --iscrypted | ||
| + | |||
| + | # Default-Benutzerkonto anlegen | ||
| + | user --name=django --password=$6$2.fGKBeQa18GE6XwDMXG6$QX/ | ||
| + | |||
| + | # vorhandene Partitionen löschen | ||
| + | #ignoredisk --only-use=sda | ||
| + | clearpart --none --initlabel | ||
| + | # autopart --type=lvm | ||
| + | |||
| + | # GUI für Installation verwendengraphical | ||
| + | graphical | ||
| + | |||
| + | # Kein X Window System konfigurieren, | ||
| + | skipx | ||
| + | |||
| + | # Reboot nach der Installation ausführen | ||
| + | reboot | ||
| + | |||
| + | %packages | ||
| + | @^minimal-environment | ||
| + | -iwl*firmware | ||
| + | vim | ||
| + | bash-completion | ||
| + | bind-utils | ||
| + | wget | ||
| + | telnet | ||
| + | net-tools | ||
| + | lsof | ||
| + | %end | ||
| + | |||
| + | %addon com_redhat_kdump --disable --reserve-mb=' | ||
| + | |||
| + | %end | ||
| + | |||
| + | %anaconda | ||
| + | pwpolicy | ||
| + | pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok | ||
| + | pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty | ||
| + | %end | ||
| + | |||
| + | # Postinstall-Anweisungen | ||
| + | %post --log=/root/anaconda-postinstall.log | ||
| + | #!/bin/bash | ||
| + | # | ||
| + | #for x in `cat /proc/ | ||
| + | #case $x in SERVERNAME*) | ||
| + | #eval $x | ||
| + | |||
| + | ############ | ||
| + | sed -i ' | ||
| + | grub2-mkconfig -o /boot/grub2/grub.cfg | ||
| ################################################################################# | ################################################################################# | ||
| - | ######################### | + | ####################### |
| - | rm -f /etc/yum/ | + | # /etc/issue.net anlegen |
| - | cat <<YUM-PLUGIN-FASTESTMIRROR | + | cat <<ISSUE.NET |
| - | [main] | + | ############################################################################## |
| - | # Django : $DATUM | + | # # |
| - | # fastestmirror deaktiviert, | + | # This is a private home server. |
| - | # default: enabled=1 | + | # # |
| - | enabled=0 | + | # |
| - | verbose=0 | + | # # |
| - | always_print_best_host = true | + | # This system is actively monitored and all connections may be logged. |
| - | socket_timeout=3 | + | # By accessing this system, you consent |
| - | # Relative paths are relative | + | # # |
| - | # as root). | + | ############################################################################## |
| - | hostfilepath=timedhosts.txt | + | ISSUE.NET |
| - | maxhostfileage=10 | + | |
| - | maxthreads=15 | + | chown root:root /etc/issue.net |
| - | #exclude=.gov, facebook | + | chmod 644 /etc/issue.net |
| - | #include_only=.nl,.de,.uk,.ie | + | |
| - | YUM-PLUGIN-FASTESTMIRROR | + | # /etc/motd anlegen |
| - | chown root:root /etc/yum/ | + | cat << |
| - | chmod 644 /etc/yum/ | + | ############################################################################## |
| + | # # | ||
| + | # This is the home server of Michael Nausch. # | ||
| + | # # | ||
| + | # | ||
| + | # # | ||
| + | # | ||
| + | # # | ||
| + | # This system is actively monitored and all connections may be logged. # | ||
| + | # By accessing this system, you consent to this monitoring. # | ||
| + | # # | ||
| + | ############################################################################## | ||
| + | MOTD | ||
| + | |||
| + | chown root:root /etc/motd | ||
| + | chmod 644 /etc/motd | ||
| ################################################################################# | ################################################################################# | ||
| ########################### | ########################### | ||
| - | rm -f / | + | cp -a / |
| cat << | cat << | ||
| - | # | + | # $OpenBSD: sshd_config, |
| # This is the sshd server system-wide configuration file. See | # This is the sshd server system-wide configuration file. See | ||
| # sshd_config(5) for more information. | # sshd_config(5) for more information. | ||
| - | # This sshd was compiled with PATH=/ | + | # This sshd was compiled with PATH=/ |
| # The strategy used for options in the default sshd_config shipped with | # The strategy used for options in the default sshd_config shipped with | ||
| Zeile 598: | Zeile 1136: | ||
| # SELinux about this change. | # SELinux about this change. | ||
| # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER | # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER | ||
| + | # | ||
| # Specifies which address family should be used by sshd(8). Valid arguments | # Specifies which address family should be used by sshd(8). Valid arguments | ||
| - | # are '' | + | # are '' |
| - | AddressFamily any | + | #AddressFamily any |
| # Specifies the local addresses sshd(8) should listen on. The following | # Specifies the local addresses sshd(8) should listen on. The following | ||
| Zeile 611: | Zeile 1149: | ||
| # Port options specified. The default is to listen on all local addresses. | # Port options specified. The default is to listen on all local addresses. | ||
| # Multiple ListenAddress options are permitted. Additionally, | # Multiple ListenAddress options are permitted. Additionally, | ||
| - | # options must precede this option for non-port qualified addresses. | + | # options must precede this option for non-port qualified addresses. |
| - | ListenAddress 0.0.0.0:22 | + | #Port 22 |
| - | + | #ListenAddress 0.0.0.0 | |
| - | # Specifies the protocol versions sshd(8) supports. The possible values are | + | #ListenAddress :: |
| - | # ' | + | |
| - | # '' | + | |
| - | # preference, because the client selects among multiple protocol versions | + | |
| - | # offered by the server. Specifying '' | + | |
| - | Protocol 2 | + | |
| # Specifies a file containing a private host key used by SSH. The default | # Specifies a file containing a private host key used by SSH. The default | ||
| Zeile 653: | Zeile 1186: | ||
| # mv " | # mv " | ||
| # | # | ||
| - | # CentOS 6 | ||
| - | # KexAlgorithms curve25519-sha256@libssh.org, | ||
| - | # CentOS 7 / Fedora >21 " | ||
| KexAlgorithms curve25519-sha256@libssh.org | KexAlgorithms curve25519-sha256@libssh.org | ||
| + | |||
| + | # Ciphers and keying | ||
| + | #RekeyLimit default none | ||
| + | |||
| + | # System-wide Crypto policy: | ||
| + | # This system is following system-wide crypto policy. The changes to | ||
| + | # Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any | ||
| + | # effect here. They will be overridden by command-line options passed on | ||
| + | # the server start up. | ||
| + | # To opt out, uncomment a line with redefinition of CRYPTO_POLICY= | ||
| + | # variable in / | ||
| + | # For more information, | ||
| # Logging | # Logging | ||
| Zeile 673: | Zeile 1215: | ||
| # clear audit track of which key was using to log in. | # clear audit track of which key was using to log in. | ||
| LogLevel VERBOSE | LogLevel VERBOSE | ||
| - | |||
| - | # Configures an external subsystem (e.g. file transfer daemon). Arguments | ||
| - | # should be a subsystem name and a command (with optional arguments) to | ||
| - | # execute upon subsystem request. Log sftp level file access | ||
| - | # (read/ | ||
| - | Subsystem sftp / | ||
| # Authentication: | # Authentication: | ||
| Zeile 715: | Zeile 1251: | ||
| # connection. Once the number of failures reaches half this value, | # connection. Once the number of failures reaches half this value, | ||
| # additional failures are logged. | # additional failures are logged. | ||
| - | MaxAuthTries | + | MaxAuthTries |
| # Specifies the maximum number of open sessions permitted per network | # Specifies the maximum number of open sessions permitted per network | ||
| Zeile 729: | Zeile 1265: | ||
| # taken to be an absolute path or one relative to the user's home directory. | # taken to be an absolute path or one relative to the user's home directory. | ||
| AuthorizedKeysFile | AuthorizedKeysFile | ||
| - | |||
| - | # Specifies whether pure RSA authentication is allowed. The default is | ||
| - | # '' | ||
| - | RSAAuthentication no | ||
| # Specifies whether public key authentication is allowed. The default is | # Specifies whether public key authentication is allowed. The default is | ||
| Zeile 738: | Zeile 1270: | ||
| PubkeyAuthentication yes | PubkeyAuthentication yes | ||
| - | # For this to work you will also need host keys in / | ||
| - | # Change to yes if you don't trust ~/ | ||
| - | # RhostsRSAAuthentication and HostbasedAuthentication | ||
| - | RhostsRSAAuthentication no | ||
| - | # Specifies whether rhosts or / | + | #AuthorizedPrincipalsFile none |
| - | # with successful public key client host authentication is allowed | + | #AuthorizedKeysCommand none |
| - | # (host-based authentication). This option is similar to | + | #AuthorizedKeysCommandUser nobody |
| - | # RhostsRSAAuthentication and applies to protocol version 2 only. | + | |
| - | HostbasedAuthentication no | + | |
| - | # Specifies whether sshd(8) should ignore the user's ~/ | + | # For this to work you will also need host keys in / |
| - | # during RhostsRSAAuthentication or HostbasedAuthentication. | + | # |
| - | IgnoreUserKnownHosts no | + | # Change to yes if you don't trust ~/ |
| + | # HostbasedAuthentication | ||
| + | #IgnoreUserKnownHosts no | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | # | ||
| - | # Specifies that .rhosts and .shosts files will not be used in | + | # To disable tunneled clear text passwords, change to no here! |
| - | # RhostsRSAAuthentication or HostbasedAuthentication. | + | #PasswordAuthentication yes |
| - | # / | + | #PermitEmptyPasswords no |
| - | IgnoreRhosts yes | + | |
| # Specifies whether password authentication is allowed. To disable tunneled | # Specifies whether password authentication is allowed. To disable tunneled | ||
| # clear text passwords, change to no here! | # clear text passwords, change to no here! | ||
| PasswordAuthentication no | PasswordAuthentication no | ||
| - | |||
| - | # When password authentication is allowed, it specifies whether the server | ||
| - | # allows login to accounts with empty password strings. The default is '' | ||
| - | PermitEmptyPasswords no | ||
| # Specifies whether challenge-response authentication is allowed | # Specifies whether challenge-response authentication is allowed | ||
| Zeile 770: | Zeile 1295: | ||
| # Change to no to disable s/key passwords | # Change to no to disable s/key passwords | ||
| ChallengeResponseAuthentication no | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| # Specifies whether user authentication based on GSSAPI is allowed. | # Specifies whether user authentication based on GSSAPI is allowed. | ||
| - | GSSAPIAuthentication | + | GSSAPIAuthentication |
| # Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key | # Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key | ||
| # exchange doesn' | # exchange doesn' | ||
| - | GSSAPIKeyExchange no | + | #GSSAPIKeyExchange no |
| # Specifies whether to automatically destroy the user's credentials cache | # Specifies whether to automatically destroy the user's credentials cache | ||
| - | # on logout. | + | # on logout. |
| - | GSSAPICleanupCredentials | + | GSSAPICleanupCredentials |
| # Determines whether to be strict about the identity of the GSSAPI acceptor | # Determines whether to be strict about the identity of the GSSAPI acceptor | ||
| Zeile 789: | Zeile 1321: | ||
| # machines. The default is '' | # machines. The default is '' | ||
| # protocol version 2 GSSAPI connections, | # protocol version 2 GSSAPI connections, | ||
| - | # work with recent Kerberos GSSAPI libraries. | + | # work with recent Kerberos GSSAPI libraries. |
| - | GSSAPIStrictAcceptorCheck yes | + | #GSSAPIStrictAcceptorCheck yes |
| - | # Controls whether the user's GSSAPI credentials should be updated following | + | #GSSAPIEnablek5users |
| - | # a successful connection rekeying. This option can be used to accepted | + | |
| - | # renewed or updated credentials from a compatible client. | + | |
| - | GSSAPIStoreCredentialsOnRekey | + | |
| - | # Specifies whether ssh-agent(1) forwarding is permitted. The default is | + | # Set this to ' |
| - | # '' | + | # and session processing. If this is enabled, PAM authentication will |
| - | # unless users are also denied shell access, as they can always install | + | # be allowed through the ChallengeResponseAuthentication and |
| - | # their own forwarders. | + | # PasswordAuthentication. |
| - | AllowAgentForwarding yes | + | # PAM authentication via ChallengeResponseAuthentication may bypass |
| - | + | # the setting of " | |
| - | # Specifies whether TCP forwarding | + | # If you just want the PAM account and session checks |
| - | # Note that disabling TCP forwarding does not improve security unless users | + | # PAM authentication, then enable this but set PasswordAuthentication |
| - | # are also denied shell access, as they can always install their own | + | # and ChallengeResponseAuthentication |
| - | # forwarders. | + | # WARNING: |
| - | AllowTcpForwarding yes | + | # problems. |
| - | + | UsePAM yes | |
| - | # Specifies whether remote hosts are allowed to connect to ports forwarded | + | |
| - | # for the client. By default, sshd(8) binds remote port forwardings to the | + | |
| - | # loopback address. This prevents other remote hosts from connecting | + | |
| - | # forwarded ports. GatewayPorts can be used to specify that sshd should | + | |
| - | # allow remote port forwardings to bind to non-loopback addresses, thus | + | |
| - | # allowing other hosts to connect. The argument may be '' | + | |
| - | # remote port forwardings to be available to the local host only, '' | + | |
| - | # to force remote port forwardings to bind to the wildcard address, or | + | |
| - | # '' | + | |
| - | # the forwarding is bound. The default is '' | + | |
| - | GatewayPorts no | + | |
| # Specifies whether X11 forwarding is permitted. The argument must be | # Specifies whether X11 forwarding is permitted. The argument must be | ||
| Zeile 841: | Zeile 1359: | ||
| # Specifies the first display number available for sshd(8)' | # Specifies the first display number available for sshd(8)' | ||
| # This prevents sshd from interfering with real X11 servers. | # This prevents sshd from interfering with real X11 servers. | ||
| - | # The default is 10. | + | # The default is 10. |
| - | X11DisplayOffset 10 | + | #X11DisplayOffset 10 |
| # Specifies whether sshd(8) should bind the X11 forwarding server to the | # Specifies whether sshd(8) should bind the X11 forwarding server to the | ||
| Zeile 852: | Zeile 1370: | ||
| # '' | # '' | ||
| # wildcard address. The argument must be '' | # wildcard address. The argument must be '' | ||
| - | # '' | + | # '' |
| - | X11UseLocalhost yes | + | #X11UseLocalhost yes |
| - | # Specifies whether | + | # Specifies whether |
| - | # interactively. (On some systems it is also printed by the shell, | + | # '' |
| - | # / | + | # unless users are also denied shell access, as they can always install |
| - | PrintMotd | + | # their own forwarders. |
| + | # | ||
| - | # Specifies whether | + | # Specifies whether |
| - | # login when a user logs in interactively. The default is '' | + | # Note that disabling TCP forwarding does not improve security unless users |
| - | PrintLastLog | + | # are also denied shell access, as they can always install their own |
| + | # forwarders. | ||
| + | # | ||
| - | # Specifies whether | + | # Specifies whether |
| - | # default is '' | + | # for the client. By default, sshd(8) binds remote |
| - | # execution. Note also, that if this is enabled, X11Forwarding will be | + | # loopback address. This prevents other remote hosts from connecting to |
| - | # disabled because login(1) does not know how to handle xauth(1) cookies. | + | # forwarded ports. GatewayPorts can be used to specify |
| - | # If UsePrivilegeSeparation is specified, it will be disabled after | + | # allow remote port forwardings to bind to non-loopback addresses, thus |
| - | # authentication. | + | # allowing other hosts to connect. The argument may be '' |
| - | UseLogin | + | # remote port forwardings to be available to the local host only, '' |
| + | # to force remote port forwardings to bind to the wildcard address, or | ||
| + | # '' | ||
| + | # the forwarding is bound. The default is '' | ||
| + | # | ||
| - | # Set this to ' | + | #PermitTTY |
| - | # and session processing. If this is enabled, PAM authentication will | + | |
| - | # be allowed through the ChallengeResponseAuthentication and | + | |
| - | # PasswordAuthentication. | + | |
| - | # PAM authentication via ChallengeResponseAuthentication may bypass | + | |
| - | # the setting of " | + | |
| - | # If you just want the PAM account and session checks to run without | + | |
| - | # PAM authentication, | + | |
| - | # and ChallengeResponseAuthentication to ' | + | |
| - | # WARNING: ' | + | |
| - | # and may cause several problems. | + | |
| - | UsePAM | + | |
| - | # Specifies whether sshd(8) separates privileges by creating an unprivileged | + | # It is recommended |
| - | # child process | + | # as it is more configurable and versatile than the built-in version. |
| - | # authentication, another process will be created that has the privilege of | + | PrintMotd no |
| - | # the authenticated user. The goal of privilege separation | + | |
| - | # privilege escalation by containing any corruption within | + | |
| - | # processes. | + | |
| - | UsePrivilegeSeparation sandbox | + | |
| - | # Sets a timeout interval in seconds after which if no data has been | + | #PrintLastLog yes |
| - | # received from the client, sshd(8) will send a message through the | + | #TCPKeepAlive yes |
| - | # encrypted channel to request a response from the client. The default is 0, | + | #PermitUserEnvironment no |
| - | # indicating that these messages will not be sent to the client. This option | + | #Compression delayed |
| - | # applies to protocol version 2 only. | + | # |
| - | ClientAliveInterval 0 | + | # |
| - | + | #ShowPatchLevel | |
| - | # Sets the number of client alive messages (see below) which may be sent | + | # |
| - | # without sshd(8) receiving any messages back from the client. If this | + | #PidFile / |
| - | # threshold is reached while client alive messages are being sent, sshd will | + | # |
| - | # disconnect the client, terminating the session. It is important to note | + | # |
| - | # that the use of client alive messages is very different from TCPKeepAlive | + | # |
| - | # (below). The client alive messages are sent through the encrypted channel | + | #VersionAddendum |
| - | # and therefore will not be spoofable. The TCP keepalive option enabled by | + | |
| - | # TCPKeepAlive is spoofable. The client alive mechanism is valuable when the | + | |
| - | # client or server depend on knowing when a connection has become inactive. | + | |
| - | # The default value is 3. If ClientAliveInterval (see below) is set to 15, | + | |
| - | # and ClientAliveCountMax is left at the default, unresponsive SSH clients | + | |
| - | # will be disconnected after approximately 45 seconds. This option applies | + | |
| - | # to protocol version 2 only. | + | |
| - | ClientAliveCountMax 3 | + | |
| - | + | ||
| - | # Specifies whether the system should send TCP keepalive messages to the | + | |
| - | # other side. If they are sent, death of the connection or crash of one of | + | |
| - | # the machines will be properly noticed. However, this means that | + | |
| - | # connections will die if the route is down temporarily, | + | |
| - | # find it annoying. On the other hand, if TCP keepalives are not sent, | + | |
| - | # sessions may hang indefinitely on the server, leaving '' | + | |
| - | # and consuming server resources. The default is '' | + | |
| - | # keepalive messages), and the server will notice if the network goes down | + | |
| - | # or the client host crashes. This avoids infinitely hanging sessions. | + | |
| - | # To disable TCP keepalive messages, the value should be set to '' | + | |
| - | TCPKeepAlive yes | + | |
| - | + | ||
| - | # Specifies whether sshd(8) should look up the remote host name and check | + | |
| - | # that the resolved host name for the remote IP address maps back to the | + | |
| - | # very same IP address. | + | |
| - | UseDNS | + | |
| - | + | ||
| - | # Specifies the file that contains the process ID of the SSH daemon. | + | |
| - | # The default is / | + | |
| - | PidFile / | + | |
| - | + | ||
| - | # Specifies the maximum number of concurrent unauthenticated connections | + | |
| - | # to the SSH daemon. Additional connections will be dropped until | + | |
| - | # authentication succeeds or the LoginGraceTime expires for a connection. | + | |
| - | # The default is 10. | + | |
| - | # Alternatively, | + | |
| - | # colon separated values '' | + | |
| - | # will refuse connection attempts with a probability of '' | + | |
| - | # if there are currently '' | + | |
| - | # probability increases linearly and all connection attempts are refused | + | |
| - | # if the number of unauthenticated connections reaches '' | + | |
| - | MaxStartups 10:30:100 | + | |
| - | + | ||
| - | # Specifies whether tun(4) device forwarding is allowed. The argument must | + | |
| - | # be '' | + | |
| - | # '' | + | |
| - | # '' | + | |
| - | PermitTunnel no | + | |
| - | + | ||
| - | # Specifies a path to chroot(2) to after authentication. This path, and all | + | |
| - | # its components, must be root-owned directories that are not writable by | + | |
| - | # any other user or group. After the chroot, sshd(8) changes the working | + | |
| - | # directory to the user's home directory. | + | |
| - | # The path may contain the following tokens that are expanded at runtime | + | |
| - | # once the connecting user has been authenticated: | + | |
| - | # literal ' | + | |
| - | # authenticated, | + | |
| - | # The ChrootDirectory | + | |
| - | # support the user's session. For an interactive session this requires at | + | |
| - | # least a shell, typically sh(1), and basic /dev nodes such as null(4), | + | |
| - | # zero(4), stdin(4), stdout(4), stderr(4), arandom(4) and tty(4) devices. | + | |
| - | # For file transfer sessions using '' | + | |
| - | # of the environment is necessary if the in-process sftp server is used, | + | |
| - | # though sessions which use logging do require /dev/log inside the chroot | + | |
| - | # directory (see sftp-server(8) for details). | + | |
| - | ChrootDirectory | + | |
| # The contents of the specified file are sent to the remote user before | # The contents of the specified file are sent to the remote user before | ||
| Zeile 981: | Zeile 1426: | ||
| AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| AcceptEnv XMODIFIERS | AcceptEnv XMODIFIERS | ||
| + | |||
| + | # Configures an external subsystem (e.g. file transfer daemon). Arguments | ||
| + | # should be a subsystem name and a command (with optional arguments) to | ||
| + | # execute upon subsystem request. Log sftp level file access | ||
| + | # (read/ | ||
| + | Subsystem sftp / | ||
| # Example of overriding settings on a per-user basis | # Example of overriding settings on a per-user basis | ||
| #Match User anoncvs | #Match User anoncvs | ||
| - | # | + | # |
| - | # | + | # |
| - | # | + | # PermitTTY no |
| - | # | + | # |
| SSHD_CONFIG | SSHD_CONFIG | ||
| chown root:root / | chown root:root / | ||
| - | chmod 644 / | + | chmod 600 / |
| ################################################################################# | ################################################################################# | ||
| Zeile 998: | Zeile 1449: | ||
| chown django: | chown django: | ||
| cat << | cat << | ||
| - | ssh-ed25519 | + | ssh-ed25519 |
| AUTHORIZED_KEYS | AUTHORIZED_KEYS | ||
| chmod 644 / | chmod 644 / | ||
| Zeile 1004: | Zeile 1455: | ||
| ################################################################################# | ################################################################################# | ||
| - | ############### | + | ############### |
| - | echo ' | + | cp -a /etc/yum.repos.d/CentOS-AppStream.repo /etc/yum.repos.d/ |
| - | ################################################################################# | + | cat <<CENTOS-APPSTREAM |
| - | + | # CentOS-AppStream.repo | |
| - | ############################# | + | |
| - | #echo "# Django : $DATUM | + | |
| - | ## default: unset (IPv6 aktiv) | + | |
| - | #net.ipv6.conf.all.disable_ipv6 = 1 | + | |
| - | # | + | |
| - | ################################################################################## | + | |
| - | + | ||
| - | ########################### | + | |
| - | rm -f / | + | |
| - | cat <<MAIN.CF | + | |
| - | # Global Postfix configuration file. This file lists only a subset | + | |
| - | # of all parameters. For the syntax, and for a complete parameter | + | |
| - | # list, see the postconf(5) manual page (command: "man 5 postconf" | + | |
| # | # | ||
| - | # For common configuration examples, see BASIC_CONFIGURATION_README | + | # The mirror system uses the connecting IP address of the client and the |
| - | # and STANDARD_CONFIGURATION_README. To find these documents, use | + | # update status of each mirror to pick mirrors that are updated to and |
| - | # the command " | + | # geographically close to the client. |
| - | # http:// | + | # unless you are manually picking other mirrors. |
| # | # | ||
| - | # For best results, change no more than 2-3 parameters at a time, | + | # If the mirrorlist= does not work for you, as a fall back you can try the |
| - | # and test if Postfix still works after every change. | + | # remarked out baseurl= line instead. |
| - | + | ||
| - | # SOFT BOUNCE | + | |
| # | # | ||
| - | # The soft_bounce parameter provides a limited safety net for | ||
| - | # testing. | ||
| - | # would otherwise bounce. This parameter disables locally-generated | ||
| - | # bounces, and prevents the SMTP server from rejecting mail permanently | ||
| - | # (by changing 5xx replies into 4xx replies). However, soft_bounce | ||
| - | # is no cure for address rewriting mistakes or mail routing mistakes. | ||
| # | # | ||
| - | # | ||
| - | # LOCAL PATHNAME INFORMATION | + | [AppStream] |
| - | # | + | name=CentOS-\$releasever - AppStream |
| - | # The queue_directory specifies the location of the Postfix queue. | + | baseurl=http:// |
| - | # This is also the root directory of Postfix daemons that run chrooted. | + | gpgcheck=1 |
| - | # See the files in examples/chroot-setup for setting up Postfix chroot | + | enabled=1 |
| - | # environments on different UNIX systems. | + | gpgkey=file:/// |
| - | # | + | CENTOS-APPSTREAM |
| - | queue_directory = /var/spool/postfix | + | chown root:root /etc/yum.repos.d/ |
| + | chmod 644 /etc/yum.repos.d/CentOS-AppStream.repo | ||
| - | # The command_directory parameter specifies the location of all | + | cp -a / |
| - | # postXXX commands. | + | cat << |
| + | # CentOS-Base.repo | ||
| # | # | ||
| - | command_directory = /usr/sbin | + | # The mirror system uses the connecting IP address |
| - | + | # update status of each mirror to pick mirrors that are updated to and | |
| - | # The daemon_directory parameter specifies | + | # geographically close to the client. You should use this for CentOS updates |
| - | # daemon programs (i.e. programs listed in the master.cf file). This | + | # unless you are manually picking other mirrors. |
| - | # directory must be owned by root. | + | |
| # | # | ||
| - | daemon_directory = / | + | # If the mirrorlist= does not work for you, as a fall back you can try the |
| - | + | # remarked out baseurl= line instead. | |
| - | # The data_directory parameter specifies | + | |
| - | # data files (caches, random numbers). This directory must be owned | + | |
| - | # by the mail_owner account (see below). | + | |
| # | # | ||
| - | data_directory = / | ||
| - | |||
| - | # QUEUE AND PROCESS OWNERSHIP | ||
| # | # | ||
| - | # The mail_owner parameter specifies the owner of the Postfix queue | ||
| - | # and of most Postfix daemon processes. | ||
| - | # account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS | ||
| - | # AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. | ||
| - | # particular, don't specify nobody or daemon. PLEASE USE A DEDICATED | ||
| - | # USER. | ||
| - | # | ||
| - | mail_owner = postfix | ||
| - | # The default_privs parameter specifies the default rights used by | + | [BaseOS] |
| - | # the local delivery agent for delivery to external file or command. | + | name=CentOS-\$releasever - Base |
| - | # These rights are used in the absence of a recipient user context. | + | baseurl=http:// |
| - | # DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER. | + | gpgcheck=1 |
| - | # | + | enabled=1 |
| - | # | + | gpgkey=file:/// |
| + | CENTOS-BASE | ||
| + | chown root:root / | ||
| + | chmod 644 / | ||
| - | # INTERNET HOST AND DOMAIN NAMES | + | cp -a /etc/yum.repos.d/ |
| - | # | + | cat << |
| - | # The myhostname parameter specifies the internet hostname of this | + | # CentOS-Extras.repo |
| - | # mail system. The default is to use the fully-qualified domain name | + | |
| - | # from gethostname(). \$myhostname is used as a default value for many | + | |
| - | # other configuration parameters. | + | |
| # | # | ||
| - | #myhostname = host.domain.tld | + | # The mirror system uses the connecting IP address of the client and the |
| - | #myhostname = virtual.domain.tld | + | # update status of each mirror to pick mirrors that are updated to and |
| - | # Django : $DATUM - Hostname setzen | + | # geographically close to the client. You should |
| - | # default: unset | + | # unless you are manually picking |
| - | myhostname = $HOSTNAME | + | |
| - | + | ||
| - | # The mydomain parameter specifies | + | |
| - | # The default is to use \$myhostname minus the first component. | + | |
| - | # \$mydomain is used as a default value for many other configuration | + | |
| - | # parameters. | + | |
| # | # | ||
| - | #mydomain | + | # If the mirrorlist= does not work for you, as a fall back you can try the |
| - | # Django : $DATUM - Domainname setzen | + | # remarked out baseurl= line instead. |
| - | # default: unset | + | |
| - | mydomain = nausch.org | + | |
| - | + | ||
| - | # SENDING MAIL | + | |
| - | # | + | |
| - | # The myorigin parameter specifies the domain that locally-posted | + | |
| - | # mail appears to come from. The default is to append \$myhostname, | + | |
| - | # which is fine for small sites. | + | |
| - | # machines, | + | |
| - | # a domain-wide alias database that aliases each user to | + | |
| - | # user@that.users.mailhost. | + | |
| # | # | ||
| - | # For the sake of consistency between sender and recipient addresses, | ||
| - | # myorigin also specifies the default domain name that is appended | ||
| - | # to recipient addresses that have no @domain part. | ||
| # | # | ||
| - | #myorigin = \$myhostname | ||
| - | #myorigin = \$mydomain | ||
| - | # Django : $DATUM Origin gesetzt | ||
| - | # default: unset | ||
| - | myorigin = \$mydomain | ||
| - | # RECEIVING MAIL | + | #additional packages that may be useful |
| + | [extras] | ||
| + | name=CentOS-\$releasever - Extras | ||
| + | baseurl=http:// | ||
| + | gpgcheck=1 | ||
| + | enabled=1 | ||
| + | gpgkey=file:/// | ||
| + | CENTOS-EXTRAS | ||
| + | chown root:root / | ||
| + | chmod 644 / | ||
| + | ################################################################################# | ||
| - | # The inet_interfaces parameter specifies the network interface | + | ###### |
| - | # addresses that this mail system receives mail on. By default, | + | dnf install epel-release -y |
| - | # the software claims all active interfaces on the machine. The | + | rpm --import https:// |
| - | # parameter also controls delivery of mail to user@[ip.address]. | + | |
| - | # | + | |
| - | # See also the proxy_interfaces parameter, for network addresses that | + | |
| - | # are forwarded to us via a proxy or network address translator. | + | |
| - | # | + | |
| - | # Note: you need to stop/start Postfix when this parameter changes. | + | |
| - | # | + | |
| - | #inet_interfaces = all | + | |
| - | #inet_interfaces = \$myhostname | + | |
| - | # | + | |
| - | inet_interfaces = localhost | + | |
| - | # Enable IPv4, and IPv6 if supported | + | cp -a / |
| - | # Django | + | cat << |
| - | # default | + | [epel-modular] |
| - | ## | + | name=Extra Packages for Enterprise Linux Modular \$releasever |
| - | inet_protocols | + | baseurl=http:// |
| + | enabled=1 | ||
| + | gpgcheck=1 | ||
| + | gpgkey=file:/// | ||
| - | # The proxy_interfaces parameter specifies the network interface | + | [epel-modular-debuginfo] |
| - | # addresses that this mail system receives mail on by way of a | + | name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Debug |
| - | # proxy or network address translation unit. This setting extends | + | baseurl=http:// |
| - | # the address list specified with the inet_interfaces parameter. | + | enabled=0 |
| - | # | + | gpgkey=file:/// |
| - | # You must specify your proxy/NAT addresses when your system is a | + | gpgcheck=1 |
| - | # backup MX host for other domains, otherwise mail delivery loops | + | |
| - | # will happen when the primary MX host is down. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The mydestination parameter specifies the list of domains that this | + | [epel-modular-source] |
| - | # machine considers itself the final destination | + | name=Extra Packages |
| - | # | + | baseurl=http://10.0.0.57/epel/\$releasever/ |
| - | # These domains are routed to the delivery agent specified with the | + | enabled=0 |
| - | # local_transport parameter setting. By default, that is the UNIX | + | gpgkey=file:/// |
| - | # compatible delivery agent that lookups all recipients in / | + | gpgcheck=1 |
| - | # and / | + | |
| - | # | + | |
| - | # The default is \$myhostname + localhost.\$mydomain. | + | |
| - | # gateway, you should also include \$mydomain. | + | |
| - | # | + | |
| - | # Do not specify the names of virtual domains | + | |
| - | # specified elsewhere (see VIRTUAL_README). | + | |
| - | # | + | |
| - | # Do not specify the names of domains that this machine is backup MX | + | |
| - | # host for. Specify those names via the relay_domains settings for | + | |
| - | # the SMTP server, or use permit_mx_backup if you are lazy (see | + | |
| - | # STANDARD_CONFIGURATION_README). | + | |
| - | # | + | |
| - | # The local machine is always the final destination for mail addressed | + | |
| - | # to user@[the.net.work.address] of an interface that the mail system | + | |
| - | # receives mail on (see the inet_interfaces parameter). | + | |
| - | # | + | |
| - | # Specify a list of host or domain names, /file/name or type:table | + | |
| - | # patterns, separated by commas and/or whitespace. A /file/name | + | |
| - | # pattern is replaced by its contents; a type:table is matched when | + | |
| - | # a name matches a lookup key (the right-hand side is ignored). | + | |
| - | # Continue long lines by starting the next line with whitespace. | + | |
| - | # | + | |
| - | # See also below, section " | + | |
| - | # | + | |
| - | mydestination = \$myhostname, localhost.\$mydomain, localhost | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # REJECTING MAIL FOR UNKNOWN LOCAL USERS | + | EPEL-MODULAR |
| - | # | + | chown root:root /etc/yum.repos.d/epel-modular.repo |
| - | # The local_recipient_maps parameter specifies optional lookup tables | + | chmod 644 /etc/yum.repos.d/epel-modular.repo |
| - | # with all names or addresses of users that are local with respect | + | |
| - | # to \$mydestination, | + | |
| - | # | + | |
| - | # If this parameter is defined, then the SMTP server will reject | + | |
| - | # mail for unknown local users. This parameter is defined by default. | + | |
| - | # | + | |
| - | # To turn off local recipient checking in the SMTP server, specify | + | |
| - | # local_recipient_maps = (i.e. empty). | + | |
| - | # | + | |
| - | # The default setting assumes that you use the default Postfix local | + | |
| - | # delivery agent for local delivery. You need to update the | + | |
| - | # local_recipient_maps setting if: | + | |
| - | # | + | |
| - | # - You define \$mydestination domain recipients in files other than | + | |
| - | # /etc/passwd, / | + | |
| - | # For example, you define \$mydestination domain recipients in | + | |
| - | # the \$virtual_mailbox_maps files. | + | |
| - | # | + | |
| - | # - You redefine the local delivery agent in master.cf. | + | |
| - | # | + | |
| - | # - You redefine the " | + | |
| - | # | + | |
| - | # - You use the " | + | |
| - | # | + | |
| - | # | + | |
| - | # Details are described in the LOCAL_RECIPIENT_README file. | + | |
| - | # | + | |
| - | # Beware: if the Postfix SMTP server runs chrooted, you probably have | + | |
| - | # to access the passwd file via the proxymap service, in order to | + | |
| - | # overcome chroot restrictions. The alternative, | + | |
| - | # the system passwd file in the chroot jail is just not practical. | + | |
| - | # | + | |
| - | # The right-hand side of the lookup tables is conveniently ignored. | + | |
| - | # In the left-hand side, specify a bare username, an @domain.tld | + | |
| - | # wild-card, or specify a user@domain.tld address. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The unknown_local_recipient_reject_code specifies the SMTP server | + | cp -a / |
| - | # response code when a recipient domain matches \$mydestination or | + | cat << |
| - | # \${proxy, | + | [epel] |
| - | # and the recipient address or address local-part is not found. | + | name=Extra Packages for Enterprise Linux \$releasever - \$basearch |
| - | # | + | baseurl=http:// |
| - | # The default setting is 550 (reject mail) but it is safer to start | + | enabled=1 |
| - | # with 450 (try again later) until you are certain that your | + | gpgcheck=1 |
| - | # local_recipient_maps settings are OK. | + | gpgkey=file:/// |
| - | # | + | |
| - | unknown_local_recipient_reject_code | + | |
| - | # TRUST AND RELAY CONTROL | + | [epel-debuginfo] |
| + | name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Debug | ||
| + | baseurl=http:// | ||
| + | enabled=0 | ||
| + | gpgkey=file:/// | ||
| + | gpgcheck=1 | ||
| - | # The mynetworks parameter specifies the list of " | + | [epel-source] |
| - | # clients that have more privileges than " | + | name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Source |
| - | # | + | baseurl=http:// |
| - | # In particular, " | + | enabled=0 |
| - | # through Postfix. See the smtpd_recipient_restrictions parameter | + | gpgkey=file:/// |
| - | # in postconf(5). | + | gpgcheck=1 |
| - | # | + | EPEL |
| - | # You can specify the list of " | + | chown root:root / |
| - | # or you can let Postfix do it for you (which is the default). | + | chmod 644 /etc/yum.repos.d/ |
| - | # | + | ##################### |
| - | # By default (mynetworks_style = subnet), Postfix " | + | |
| - | # clients in the same IP subnetworks as the local machine. | + | |
| - | # On Linux, this does works correctly only with interfaces specified | + | |
| - | # with the " | + | |
| - | # | + | |
| - | # Specify " | + | |
| - | # clients in the same IP class A/B/C networks as the local machine. | + | |
| - | # Don't do this with a dialup site - it would cause Postfix to " | + | |
| - | # your entire provider' | + | |
| - | # mynetworks list by hand, as described below. | + | |
| - | # | + | |
| - | # Specify " | + | |
| - | # only the local machine. | + | |
| - | # | + | |
| - | #mynetworks_style = class | + | |
| - | #mynetworks_style = subnet | + | |
| - | #mynetworks_style = host | + | |
| - | # Alternatively, | + | ############################ |
| - | # which case Postfix ignores the mynetworks_style setting. | + | dnf update |
| - | # | + | ################################################################################# |
| - | # Specify an explicit list of network/ | + | ;; |
| - | # mask specifies the number of bits in the network part of a host | + | esac; |
| - | # address. | + | done |
| - | # | + | %end |
| - | # You can also specify the absolute pathname of a pattern file instead | + | </file> |
| - | # of listing the patterns here. Specify type:table for table-based lookups | + | |
| - | # (the value on the table right-hand side is not used). | + | |
| - | # | + | |
| - | #mynetworks = 168.100.189.0/ | + | |
| - | #mynetworks = \$config_directory/ | + | |
| - | #mynetworks = hash:/etc/ | + | |
| - | # The relay_domains parameter restricts what destinations this system will | + | Neben der Grundinstallation eines CentOS 8 Hosts werden wir nun noch folgende Dinge setzen lassen: |
| - | # relay mail to. See the smtpd_recipient_restrictions description in | + | - **[[centos: |
| - | # postconf(5) for detailed information. | + | - **[[centos: |
| - | # | + | - **[[centos:ssh_c7#ssh-daemon|SSH-Daemon]]** Den SSH Daemon härten wir und passen die Konfigurationsdatei entsprechend an. |
| - | # By default, Postfix relays mail | + | - **[[centos: |
| - | # - from " | + | - **[[wiki:start#repos|Repositories]]** Statt der öffentlichen, sollen nur noch die lokal gesyncten Repositories verwendet werden; daher macht es auch keinen Sinn die Einträge **'' |
| - | # - from " | + | - **Update** Zum Schluss stellen wir noch sicher dass alle installierten Pakete |
| - | # | + | |
| - | # The default relay_domains value is \$mydestination. | + | |
| - | # | + | |
| - | # In addition to the above, the Postfix SMTP server by default accepts mail | + | |
| - | # that Postfix is final destination for: | + | |
| - | # - destinations that match \$inet_interfaces or \$proxy_interfaces, | + | |
| - | # - destinations that match \$mydestination | + | |
| - | # - destinations that match \$virtual_alias_domains, | + | |
| - | # - destinations that match \$virtual_mailbox_domains. | + | |
| - | # These destinations do not need to be listed in \$relay_domains. | + | |
| - | # | + | |
| - | # Specify a list of hosts or domains, /file/name patterns or type:name | + | |
| - | # lookup tables, separated by commas and/or whitespace. | + | |
| - | # long lines by starting the next line with whitespace. A file name | + | |
| - | # is replaced by its contents; a type:name table is matched when a | + | |
| - | # (parent) domain appears as lookup key. | + | |
| - | # | + | |
| - | # NOTE: Postfix will not automatically forward mail for domains that | + | |
| - | # list this system as their primary or backup MX host. See the | + | |
| - | # permit_mx_backup restriction description | + | |
| - | # | + | |
| - | # | + | |
| - | # INTERNET OR INTRANET | + | Der Form halber setzen wir dann die Dateiberechtigungen auf **444** |
| + | # chmod 444 / | ||
| - | # The relayhost parameter specifies the default host to send mail to | + | Damit wir die beim Booten verwendete Datei **'' |
| - | # when no entry is matched in the optional transport(5) table. When | + | |
| - | # no relayhost is given, mail is routed directly to the destination. | + | |
| - | # | + | |
| - | # On an intranet, specify the organizational domain name. If your | + | |
| - | # internal DNS uses no MX records, specify the name of the intranet | + | |
| - | # gateway host instead. | + | |
| - | # | + | |
| - | # In the case of SMTP, specify a domain, host, host:port, [host]: | + | |
| - | # [address] or [address]: | + | |
| - | # | + | |
| - | # If you're connected via UUCP, see also the default_transport parameter. | + | |
| - | # | + | |
| - | #relayhost = \$mydomain | + | |
| - | #relayhost = [gateway.my.domain] | + | |
| - | #relayhost = [mailserver.isp.tld] | + | |
| - | #relayhost = uucphost | + | |
| - | #relayhost = [an.ip.add.ress] | + | |
| - | # Django : $DATUM Relayhost auf mx01.nausch.org gesetzt | + | |
| - | # default: unset | + | |
| - | relayhost = dmz.nausch.org | + | |
| - | # REJECTING UNKNOWN RELAY USERS | + | Nun können wir den Bootparameter anpassen und die Kickstart-Datei angeben. Dabei setzen wir **'' |
| - | # | + | |
| - | # The relay_recipient_maps parameter specifies optional lookup tables | + | |
| - | # with all addresses in the domains that match \$relay_domains. | + | |
| - | # | + | |
| - | # If this parameter is defined, then the SMTP server will reject | + | |
| - | # mail for unknown relay users. This feature is off by default. | + | |
| - | # | + | |
| - | # The right-hand side of the lookup tables is conveniently ignored. | + | |
| - | # In the left-hand side, specify an @domain.tld wild-card, or specify | + | |
| - | # a user@domain.tld address. | + | |
| - | # | + | |
| - | # | + | |
| - | # INPUT RATE CONTROL | + | < |
| - | # | + | |
| - | # The in_flow_delay configuration parameter implements mail input | + | |
| - | # flow control. This feature is turned on by default, although it | + | |
| - | # still needs further development (it's disabled on SCO UNIX due | + | |
| - | # to an SCO bug). | + | |
| - | # | + | |
| - | # A Postfix process will pause for \$in_flow_delay seconds before | + | |
| - | # accepting a new message, when the message arrival rate exceeds the | + | |
| - | # message delivery rate. With the default 100 SMTP server process | + | |
| - | # limit, this limits the mail inflow to 100 messages a second more | + | |
| - | # than the number of messages delivered per second. | + | |
| - | # | + | |
| - | # Specify 0 to disable the feature. Valid delays are 0..10. | + | |
| - | # | + | |
| - | # | + | |
| - | # ADDRESS REWRITING | + | label linux |
| - | # | + | menu label ^Install CentOS Linux 8.0.1905 |
| - | # The ADDRESS_REWRITING_README document gives information about | + | |
| - | # address masquerading or other forms of address rewriting including | + | |
| - | # username-> | + | |
| - | # ADDRESS REDIRECTION (VIRTUAL DOMAIN) | + | ... |
| - | # | + | <</ |
| - | # The VIRTUAL_README document gives information about the many forms | + | |
| - | # of domain hosting that Postfix supports. | + | |
| - | # "USER HAS MOVED" BOUNCE MESSAGES | + | <WRAP center round important 75%> |
| - | # | + | Wichtig ist dabei der Parameter **'' |
| - | # See the discussion in the ADDRESS_REWRITING_README document. | + | Diesen Wert müssen wir später beim Erstellen des eigenen Boot-ISO-Image genau gleich angeben! |
| + | </ | ||
| - | # TRANSPORT MAP | + | Nun können wir die Dateiberechtigung dieser DAte wieder auf **444** zhurücksetzen. |
| - | # | + | |
| - | # See the discussion in the ADDRESS_REWRITING_README document. | + | |
| - | # ALIAS DATABASE | + | Anschließend packen wir den Inhalt des ursprünglichen ISO-Images mit unserem Kickstart-File wie auch unseren Ändewrungen neu ein. Das LAbel, welches wir zuvor in der Konfigurationsdatei **'' |
| - | # | + | |
| - | # The alias_maps parameter specifies the list of alias databases used | + | |
| - | # by the local delivery agent. The default list is system dependent. | + | |
| - | # | + | |
| - | # On systems with NIS, the default is to search the local alias | + | |
| - | # database, then the NIS alias database. See aliases(5) for syntax | + | |
| - | # details. | + | |
| - | # | + | |
| - | # If you change the alias database, run " | + | |
| - | # wherever your system stores the mail alias file), or simply run | + | |
| - | # " | + | |
| - | # | + | |
| - | # It will take a minute or so before changes become visible. Use | + | |
| - | # " | + | |
| - | # | + | |
| - | #alias_maps = dbm:/ | + | |
| - | alias_maps = hash:/ | + | |
| - | #alias_maps = hash:/ | + | |
| - | #alias_maps = netinfo:/ | + | |
| - | # The alias_database parameter specifies the alias database(s) that | + | Bevor wir nun das neu erstellte ISO-IMage verwenden können, ist es noch notwendig diese Date mit einer MD5-Prüfsumme zu versehen. |
| - | # are built with " | + | |
| - | # configuration parameter, because alias_maps (see above) may specify | + | |
| - | # tables that are not necessarily all under control by Postfix. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | alias_database = hash:/ | + | |
| - | # | + | |
| - | # ADDRESS EXTENSIONS (e.g., user+foo) | + | Nun können wir unser eigenes ISO-Image verenden. |
| - | # | + | |
| - | # The recipient_delimiter parameter specifies the separator between | + | |
| - | # user names and address extensions (user+foo). See canonical(5), | + | |
| - | # local(8), relocated(5) and virtual(5) for the effects this has on | + | |
| - | # aliases, canonical, virtual, relocated and .forward file lookups. | + | |
| - | # Basically, the software tries user+foo and .forward+foo before | + | |
| - | # trying user and .forward. | + | |
| - | # | + | |
| - | # | + | |
| - | # DELIVERY TO MAILBOX | + | {{ : |
| - | # | + | |
| - | # The home_mailbox parameter specifies the optional pathname of a | + | |
| - | # mailbox file relative to a user's home directory. The default | + | |
| - | # mailbox file is / | + | |
| - | # " | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # The mail_spool_directory parameter specifies the directory where | + | |
| - | # UNIX-style mailboxes are kept. The default setting depends on the | + | |
| - | # system type. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The mailbox_command parameter specifies the optional external | + | <WRAP center round tip 80%> |
| - | # command to use instead of mailbox delivery. The command is run as | + | |
| - | # the recipient with proper HOME, SHELL and LOGNAME environment settings. | + | |
| - | # Exception: | + | |
| - | # | + | |
| - | # Other environment variables of interest: USER (recipient username), | + | |
| - | # EXTENSION (address extension), DOMAIN (domain part of address), | + | |
| - | # and LOCAL (the address localpart). | + | |
| - | # | + | |
| - | # Unlike other Postfix configuration parameters, the mailbox_command | + | |
| - | # parameter is not subjected to \$parameter substitutions. This is to | + | |
| - | # make it easier to specify shell syntax (see example below). | + | |
| - | # | + | |
| - | # Avoid shell meta characters because they will force Postfix to run | + | |
| - | # an expensive shell process. Procmail alone is expensive enough. | + | |
| - | # | + | |
| - | # IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, | + | |
| - | # ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The mailbox_transport specifies the optional transport in master.cf | + | Nachdem wir die Festplattenkonfiguration vorgenommen haben, können wir mit einem Klick auf die Schaltfläche **[ Begin Installation |
| - | # to use after processing aliases and .forward files. This parameter | + | |
| - | # has precedence over the mailbox_command, fallback_transport and | + | |
| - | # luser_relay parameters. | + | |
| - | # | + | |
| - | # Specify a string of the form transport: | + | |
| - | # the name of a mail delivery transport defined in master.cf. | + | |
| - | # :nexthop part is optional. For more details see the sample transport | + | |
| - | # configuration file. | + | |
| - | # | + | |
| - | # NOTE: if you use this feature for accounts not in the UNIX password | + | |
| - | # file, then you must update the " | + | |
| - | # the main.cf file, otherwise the SMTP server will reject mail for | + | |
| - | # non-UNIX accounts with "User unknown in local recipient table" | + | |
| - | # | + | |
| - | # Cyrus IMAP over LMTP. Specify ``lmtpunix | + | |
| - | # listen="/ | + | |
| - | # | + | |
| - | # If using the cyrus-imapd IMAP server deliver local mail to the IMAP | + | {{ :centos:pxe_c8:kickstart-iso-8-2.png? |
| - | # server using LMTP (Local Mail Transport Protocol), this is prefered | + | |
| - | # over the older cyrus deliver program by setting the | + | |
| - | # mailbox_transport as below: | + | |
| - | # | + | |
| - | # mailbox_transport = lmtp:unix:/ | + | |
| - | # | + | |
| - | # The efficiency of LMTP delivery for cyrus-imapd can be enhanced via | + | |
| - | # these settings. | + | |
| - | # | + | |
| - | # local_destination_recipient_limit = 300 | + | |
| - | # local_destination_concurrency_limit = 5 | + | |
| - | # | + | |
| - | # Of course you should adjust these settings as appropriate for the | + | |
| - | # capacity of the hardware you are using. The recipient limit setting | + | |
| - | # can be used to take advantage of the single instance message store | + | |
| - | # capability of Cyrus. The concurrency limit can be used to control | + | |
| - | # how many simultaneous LMTP sessions will be permitted to the Cyrus | + | |
| - | # message store. | + | |
| - | # | + | |
| - | # Cyrus IMAP via command line. Uncomment the " | + | |
| - | # subsequent line in master.cf. | + | |
| - | # | + | |
| - | # The fallback_transport specifies the optional transport in master.cf | + | Wir sehen nun auch, dass dasroot-Passwort wie auch unser Admin-Acccount bereits gesetzt sind. |
| - | # to use for recipients that are not found in the UNIX passwd database. | + | |
| - | # This parameter has precedence over the luser_relay parameter. | + | |
| - | # | + | |
| - | # Specify a string of the form transport: | + | |
| - | # the name of a mail delivery transport defined in master.cf. | + | |
| - | # :nexthop part is optional. For more details see the sample transport | + | |
| - | # configuration file. | + | |
| - | # | + | |
| - | # NOTE: if you use this feature for accounts not in the UNIX password | + | |
| - | # file, then you must update the " | + | |
| - | # the main.cf file, otherwise the SMTP server will reject mail for | + | |
| - | # non-UNIX accounts with "User unknown in local recipient table". | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The luser_relay parameter specifies an optional destination address | + | {{ :centos:pxe_c8: |
| - | # for unknown recipients. | + | |
| - | # unknown@[\$inet_interfaces] or unknown@[\$proxy_interfaces] is returned | + | |
| - | # as undeliverable. | + | |
| - | # | + | |
| - | # The following expansions are done on luser_relay: | + | |
| - | # username), \$shell (recipient shell), \$home (recipient home directory), | + | |
| - | # \$recipient (full recipient address), \$extension (recipient address | + | |
| - | # extension), \$domain (recipient domain), \$local (entire recipient | + | |
| - | # localpart), \$recipient_delimiter. Specify \${name?value} or | + | |
| - | # \${name:value} to expand value only when \$name does (does not) exist. | + | |
| - | # | + | |
| - | # luser_relay works only for the default Postfix local delivery agent. | + | |
| - | # | + | |
| - | # NOTE: if you use this feature for accounts not in the UNIX password | + | |
| - | # file, then you must specify " | + | |
| - | # the main.cf file, otherwise the SMTP server will reject mail for | + | |
| - | # non-UNIX accounts with "User unknown in local recipient table" | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # JUNK MAIL CONTROLS | + | |
| - | # | + | |
| - | # The controls listed here are only a very small subset. The file | + | |
| - | # SMTPD_ACCESS_README provides an overview. | + | |
| - | # The header_checks parameter specifies an optional table with patterns | + | Kurz vor dem Ende, also dem Neustart unseres neuen **CentOS 8** Systems bekommen wir auch noch den Hinweis, dass unsere Postinstall-Anweisungen ausgeführt werden. |
| - | # that each logical message header is matched against, including | + | |
| - | # headers that span multiple physical lines. | + | |
| - | # | + | |
| - | # By default, these patterns | + | |
| - | # headers of attached messages. With older Postfix versions, MIME and | + | |
| - | # attached message headers were treated as body text. | + | |
| - | # | + | |
| - | # For details, see "man header_checks" | + | |
| - | # | + | |
| - | # | + | |
| - | # FAST ETRN SERVICE | + | {{ : |
| - | # | + | |
| - | # Postfix maintains per-destination logfiles with information about | + | |
| - | # deferred mail, so that mail can be flushed quickly with the SMTP | + | |
| - | # "ETRN domain.tld" | + | |
| - | # See the ETRN_README document for a detailed description. | + | |
| - | # | + | |
| - | # The fast_flush_domains parameter controls what destinations are | + | |
| - | # eligible for this service. By default, they are all domains that | + | |
| - | # this server is willing to relay mail to. | + | |
| - | # | + | |
| - | # | + | |
| - | # SHOW SOFTWARE VERSION OR NOT | + | Anschließend ist das System unseren Wunschen nach vorbereitet und wir können uns anmelden. |
| - | # | + | |
| - | # The smtpd_banner parameter specifies the text that follows the 220 | + | |
| - | # code in the SMTP server' | + | |
| - | # the mail version advertised. By default, Postfix shows no version. | + | |
| - | # | + | |
| - | # You MUST specify \$myhostname at the start of the text. That is an | + | |
| - | # RFC requirement. Postfix itself does not care. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # PARALLEL DELIVERY TO THE SAME DESTINATION | + | {{ : |
| - | # | + | |
| - | # How many parallel deliveries to the same user or domain? With local | + | |
| - | # delivery, it does not make sense to do massively parallel delivery | + | |
| - | # to the same user, because mailbox updates must happen sequentially, | + | |
| - | # and expensive pipelines in .forward files can cause disasters when | + | |
| - | # too many are run at the same time. With SMTP deliveries, 10 | + | |
| - | # simultaneous connections to the same domain could be sufficient to | + | |
| - | # raise eyebrows. | + | |
| - | # | + | |
| - | # Each message delivery transport has its XXX_destination_concurrency_limit | + | |
| - | # parameter. | + | |
| - | # most delivery transports. For the local delivery agent the default is 2. | + | |
| - | # | + | Wir können uns nun auch direkt an unserem Host per **'' |
| - | # | + | $ ssh 10.0.0.250 |
| - | # DEBUGGING CONTROL | + | < |
| - | # | + | ED25519 key fingerprint is SHA256: |
| - | # The debug_peer_level parameter specifies the increment in verbose | + | Are you sure you want to continue connecting (yes/no)? yes |
| - | # logging level when an SMTP client or server | + | Warning: Permanently added ' |
| - | # matches a pattern in the debug_peer_list parameter. | + | ############################################################################# |
| - | # | + | # # |
| - | debug_peer_level = 2 | + | # This is a private home server. # |
| + | # # | ||
| + | # | ||
| + | # # | ||
| + | # This system is actively monitored and all connections may be logged. | ||
| + | # By accessing this system, you consent to this monitoring. | ||
| + | # # | ||
| + | ############################################################################## | ||
| + | ############################################################################## | ||
| + | # # | ||
| + | # This is the home server of Michael Nausch. # | ||
| + | # | ||
| + | # vml000250.nausch.org | ||
| + | # # | ||
| + | # | ||
| + | # # | ||
| + | # This system is actively monitored and all connections may be logged. | ||
| + | # By accessing this system, you consent to this monitoring. | ||
| + | # # | ||
| + | ############################################################################## | ||
| + | Last login: Sun Jun 14 22:06:00 2020 from 10.0.0.27</ | ||
| - | # The debug_peer_list parameter specifies an optional list of domain | + | Die Netzwerkschnittstelle hat entsprechend die gewünschte Bezeichnung erhalten. |
| - | # or network patterns, /file/name patterns or type:name tables. When | + | |
| - | # an SMTP client or server host name or address matches | + | |
| - | # increase the verbose logging level by the amount specified in the | + | |
| - | # debug_peer_level parameter. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # The debugger_command specifies the external command that is executed | + | < |
| - | # when a Postfix daemon program is run with the -D option. | + | |
| - | # | + | inet 127.0.0.1/8 scope host lo |
| - | # Use " | + | valid_lft forever preferred_lft forever |
| - | # the process marches on. If you use an X-based debugger, be sure to | + | inet6 ::1/128 scope host |
| - | # set up your XAUTHORITY environment variable before starting Postfix. | + | valid_lft forever preferred_lft forever |
| - | # | + | 2: eth0: < |
| - | debugger_command = | + | link/ether 52:54: |
| - | | + | inet 10.0.0.250/24 brd 10.0.0.255 scope global noprefixroute eth0 |
| - | ddd \$daemon_directory/\$process_name \$process_id & sleep 5 | + | |
| + | inet6 fe80:: | ||
| + | valid_lft forever preferred_lft forever</code> | ||
| - | # If you can't use X, use this to capture the call stack when a | + | Das System ist auch mit den aktuellesten Programmpaketen bestückt. |
| - | # daemon crashes. The result is in a file in the configuration | + | |
| - | # directory, and is named after the process name and the process ID. | + | |
| - | # | + | |
| - | # debugger_command = | + | |
| - | # | + | |
| - | # echo where) | gdb \$daemon_directory/ | + | |
| - | # | + | |
| - | # | + | |
| - | # Another possibility is to run gdb under a detached screen session. | + | |
| - | # To attach to the screen sesssion, su root and run " | + | |
| - | # < | + | |
| - | # sessions (from " | + | |
| - | # | + | |
| - | # debugger_command = | + | |
| - | # | + | |
| - | # -dmS \$process_name gdb \$daemon_directory/ | + | |
| - | # \$process_id & sleep 1 | + | |
| - | # INSTALL-TIME CONFIGURATION INFORMATION | + | < |
| - | # | + | Dependencies resolved. |
| - | # The following parameters are used when installing a new Postfix version. | + | Nothing to do. |
| - | # | + | Complete!< |
| - | # sendmail_path: | + | |
| - | # This is the Sendmail-compatible mail posting interface. | + | |
| - | # | + | |
| - | sendmail_path = /usr/ | + | |
| - | # newaliases_path: | + | ====== Links ====== |
| - | # This is the Sendmail-compatible command to build alias databases. | + | * **[[centos: |
| - | # | + | * **[[wiki: |
| - | newaliases_path = /usr/bin/newaliases.postfix | + | * **[[http://dokuwiki.nausch.org/doku.php/ |
| - | # mailq_path: The full pathname of the Postfix mailq command. | ||
| - | # is the Sendmail-compatible mail queue listing command. | ||
| - | # | ||
| - | mailq_path = / | ||
| - | |||
| - | # setgid_group: | ||
| - | # commands. | ||
| - | # is not shared with other accounts, not even with the Postfix account. | ||
| - | # | ||
| - | setgid_group = postdrop | ||
| - | |||
| - | # html_directory: | ||
| - | # | ||
| - | html_directory = no | ||
| - | |||
| - | # manpage_directory: | ||
| - | # | ||
| - | manpage_directory = / | ||
| - | |||
| - | # sample_directory: | ||
| - | # This parameter is obsolete as of Postfix 2.1. | ||
| - | # | ||
| - | sample_directory = / | ||
| - | |||
| - | # readme_directory: | ||
| - | # | ||
| - | readme_directory = / | ||
| - | MAIN.CF | ||
| - | chown root:root / | ||
| - | chmod 644 / | ||
| - | ################################################################################# | ||
| - | |||
| - | ######################### | ||
| - | rm -f / | ||
| - | cat << | ||
| - | # These servers were defined in the installation: | ||
| - | # Django : $DATUM | ||
| - | # Definition des hauseigenen NTP-Servers: | ||
| - | server time.dmz.nausch.org iburst | ||
| - | # Use public servers from the pool.ntp.org project. | ||
| - | # Please consider joining the pool (http:// | ||
| - | |||
| - | # Ignore stratum in source selection. | ||
| - | stratumweight 0 | ||
| - | |||
| - | # Record the rate at which the system clock gains/ | ||
| - | driftfile / | ||
| - | |||
| - | # Enable kernel RTC synchronization. | ||
| - | rtcsync | ||
| - | |||
| - | # In first three updates step the system clock instead of slew | ||
| - | # if the adjustment is larger than 10 seconds. | ||
| - | makestep 10 3 | ||
| - | |||
| - | # Allow NTP client access from local network. | ||
| - | #allow 192.168/16 | ||
| - | | ||
| - | # Listen for commands only on localhost. | ||
| - | bindcmdaddress 127.0.0.1 | ||
| - | # Django : $DATUM | ||
| - | # default: bindcmdaddress ::1 | ||
| - | |||
| - | # This option allows you to configure the port on which chronyd will listen for NTP requests. | ||
| - | # | ||
| - | # The compiled in default is udp/123, the standard NTP port. If set to 0, chronyd will not | ||
| - | # open the server socket and will operate strictly in a client-only mode. The source port | ||
| - | # used in NTP client requests can be set by the acquisitionport directive. | ||
| - | # Django : $DATUM | ||
| - | # default: unset | ||
| - | port 0 | ||
| - | |||
| - | |||
| - | # Serve time even if not synchronized to any NTP server. | ||
| - | #local stratum 10 | ||
| - | |||
| - | keyfile / | ||
| - | |||
| - | # Specify the key used as password for chronyc. | ||
| - | commandkey 1 | ||
| - | |||
| - | # Generate command key if missing. | ||
| - | generatecommandkey | ||
| - | |||
| - | # Disable logging of client accesses. | ||
| - | noclientlog | ||
| - | |||
| - | # Send a message to syslog if a clock adjustment is larger than 0.5 seconds. | ||
| - | logchange 0.5 | ||
| - | |||
| - | logdir / | ||
| - | #log measurements statistics tracking | ||
| - | CHRONY.CONF | ||
| - | chown root:root / | ||
| - | chmod 644 / | ||
| - | |||
| - | cat << | ||
| - | # Django : $DATUM | ||
| - | # disable IPv6 support | ||
| - | OPTIONS=-4 | ||
| - | CHRONYD | ||
| - | chown root:root / | ||
| - | chmod 644 / | ||
| - | ################################################################################# | ||
| - | |||
| - | ;; | ||
| - | esac; | ||
| - | done | ||
| - | %end | ||
| - | </ | ||
| - | |||
| - | Damit nun beim Laden der Menüdatei bei PXE-Boot die überarbeitete Kickstart-Datei geladen werden kann, erweitern wir nun die Menü-Datei unseres PXE-Bootservers. | ||
| - | |||
| - | # vim / | ||
| - | Dort tragen wir beim betreffenden **LABEL** die Option **ks** sowie am Ende der Zeile **SERVERNAME=** ein. | ||
| - | < | ||
| - | MENU LABEL ^3) Installation von CentOS 7 (64 Bit) | ||
| - | | ||
| - | | ||
| - | </ | ||
| - | |||
| - | Anschliessend starten wir wie gewohnt unsere virtuelle Maschine. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Zum Setzen des Hostnamens wählen wir nun wie gewünscht den betreffenden Menüpunkt aus, drücken dann aber **__NICHT__** die **EINGABETASTE**, | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Nach kurzer Wartezeit haben wir ein neues, vorkonfiguriertes und vor allem aktuelles System. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | FIXME **//do gehds weida!//** | ||
| - | ==== Bsp. 4: Kickstart für eigene Installationsimages/ | ||
django